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(54) Telecommunications system 

(57) In a telecommunications system such as a glo- 
bal mobile telephone network in which each subscriber 
unit includes a Subscriber Identity Module (SIM card), 
each SIM card has fixed memory locations (22), to 
which data can be addressed over the air. The locations 
(22) can be accessed from the subscriber unit on the 
entry of short simple codes, each associated with one of 
the locations. Further fixed memory locations (24) can 
be read over the air only when the subscriber enters a 
personal identification number. Also, the SIM contains 
means which are operable to act on receipt of a signal, 
from the user of the subscriber unit or from a host sta- 
tion, to determine and undertake an appropriate 
response to the signal. 
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Description 

This invention relates to a telecommunications sys- 
tem. In particular, but not exclusively, it relates to a 
mobile communications system such as a cellular s 
mobile radio or telephone system. 

A recent innovation in such systems has been the 
introduction of Subscriber Identity Modules (SIM cards). 
These are integrated circuit cards which can be releas- 
ably inserted into a mobile telephone and which contain 10 
in memory the subscriber's identity, i.e. his telephone 
number. These known SIM cards also have a memory 
area which can store a certain number of alphanumeric 
characters. The memory area facilitates the so-called 
Short Message Service (SMS) in which a message for a 15 
subscriber or for a specified group of subscribers can be 
broadcast over the air, as an advanced form of radiop- 
aging. Messages can be received by a mobile tele- 
phone whenever it is idle or during a call. However, if a 
message is received which would overfill the memory 20 
area, data is held at the host station until such time as 
the subscriber manually clears a space for it. 

US-A5 127 040 describes a method and apparatus 
for remotely loading repertory telephone numbers into a 
mobile unit The numbers can be recalled and used 25 
later by the subscriber. 

EP-A-0 459 344 describes a method of download- 
ing and executing software in a remote terminal of a 
communications system. 

WO-A-91/12698 discloses a mobile radio tele- 30 
phone having a SIM card which has been programmed 
only to authorize the use of certain services. Such pro- 
gramming takes place directly and not remotely. 

It is an object of the invention to provide a more effi- 
cient and remotely reconfigurable SIM card. 35 

From one aspect, the present invention consists in 
a telecommunications system comprising at least one 
host station and a plurality of subscriber units, the or 
each host station being operable to transmit a message 
to at least one of the subscriber units, and each sub- aq 
scriber unit having a multiplicity of fixed memory loca- 
tions and means responsive to the detection of the 
message to store the message in a selected one of the 
fixed memory locations, which can be accessed from 
the subscriber unit when required, said memory I oca- 45 
tions (22) being provided in an integrated circuit card (7) 
or other module which is removably connected to said 
subscriber unit, characterized in that each subscriber 
unit is adapted to transmit a signal, from the or each 
host station or the user of said subscriber unit, to said so 
module, said module containing means operable to act 
on receipt of such a signal to determine and undertake 
an appropriate response to said signal. 

Thus, for example, a set of telephone numbers, 
each with an identifying alphanumeric tag, can be trans- 55 
mitted to the SIM card, allowing users easy access to 
commonly used services such as hotels, car hire or air- 
line reservations. This feature is known as a Value 
Added Service Directory. 



A message may be retrievable by the subscriber on 
the entry of simple, short codes into the subscriber unit, 
each memory location corresponding to a particular 
code. A message may include a telephone number and, 
once stored, may be able to be overwritten over the air. 
Preferably, the or each host station is operable to trans- 
mit a request for information stored in a subscriber unit. 
The information may be included in a message and it 
may also include information which is stored in a secure 
memory location, accessible only when the subscriber 
enters a personal identification number (PIN number). 
The information may include credit details relevant to 
the subscriber, for example, a credit card number of 
credit status, thus greatly facilitating credit card transac- 
tions carried out over the telephone. Using this feature 
of the invention, a credit account holder avoids having to 
dictate his account details and need only enter the man- 
datory PIN number. 

The host station may be operable to transmit 
instructions to lock and/or unlock a memory location at 
the subscriber unit It may be operable to transmit 
instructions to run a program stored in memory loca- 
tions at the subscriber unit The host station may be 
operable to transmit files containing functional data 
and/or files containing non-functional data to the sub- 
scriber unit. 

The messages, requests for information and the 
instructions being transmitted may be in a specific for- 
mat which the subscriber unit is able to distinguish from 
other formats. The specific format may be made secure 
against interception. 

In a preferred embodiment the subscriber unit 
comprises a mobile radio or telephone and an inte- 
grated circuit card which can be removably connected 
to the radio-telephone. The integrated circuit card may 
contain the memory locations and may contain means 
for distinguishing the specific format from other formats. 
The card may contain means for distinguishing between 
the messages, requests for information and instruc- 
tions. The card may also contain the means for storing 
the messages and means for acting on the requests 
and instructions. 

From another aspect, the invention consists in a 
module for controlling a subscriber unit in a telecommu- 
nications system comprising at least one host station, 
said module being removably connectabie to a trans- 
ceiver of the subscriber unit, and comprising a multiplic- 
ity of fixed memory locations, and means responsive to 
the detection of a message transmitted remotely thereto 
to store the message in a selected one of the fixed 
memory locations, characterised by response means 
operable to act on receipt of a signal, from the or each 
host station or the user of said subscriber unit, to deter- 
mine and undertake an appropriate response to said 
signal. 

The module may include a directory structure within 
which files can be stored. 

The invention is particularly applicable to global tel- 
ecommunication systems in which the mobile cellular 
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telephone networks of various countries or areas com- 
municate using a common standard. An example of 
such a global system is GSM (Global System for Mobile 
Communications) currently operating in Europe. How- 
ever the invention is not limited to global systems and 
would be applied to a single national cellular network or 
even to a fixed land-linked network. 

An embodiment of the invention will now be 
described by way of example with reference to the 
accompanying drawings in which:- 

Figure 1 shows the transmission of messages to a 
subscriber unit in a system according to the inven- 
tion; 

Figure 2 shows a process in which a subscriber unit 
transmits a message and requested information; 
Figure 3 is a block diagram showing elements of a 
module shown in figures 1 and 2; 
1 Figure 4 shows details of one of the blocks shown in 
figure 3; and 

Figure 5 is a flowchart showing the operation of the 
module shown in figures 1 to 4. 

Figure 1 illustrates an SMS distribution path 
according to the invention. In the prior art, the short 
messages have usually been directed to a single sub- 
scriber or a specified group of subscribers such as a 
sales team. 

However, GSM also supports a feature known as 
Cell Broadcast in which messages can be sent to all the 
subscribers in a particular area. In the embodiment of 
the invention illustrated, a message consists of the tele- 
phone number of an advertiser and an alphanumeric 
tag to identify the advertiser. 

An operator enters the message into a terminal 1. 
The message is then coded into a secure format known 
as an Embedded Command Stream (ECS) and sent via 
a modem 2 and a fixed line 3 to a local GSM switch 4. 
According to its delivery address, the message is deliv- 
ered to any or all of the other switches within that net- 
work, or even across networks. 

The switch 4, which in this example is in the geo- 
graphical area to which the message is to be transmit- 
ted, delivers the message to a number of cellsites 5. 
The cellsites 5 are the base transceiver stations of the 
GSM network. 

Each cellsite 5 then broadcasts the message to a 
group of transceivers or mobile telephones, hereinafter 
referred to as "mobiles". If Cell Broadcast is used, the 
group consists of all mobiles within the geographical 
area at the time of the broadcast 

A selected mobile 6 receiving the message trans- 
mits a confirmation of receipt back to its respective cell- 
site 5. From now on, until an update situation, the 
system will not contact this mobile 6 again. 

The mobile 6 recognizes the message as SMS data 
and passes it to a SIM card 7, which is a small self-con- 
tained microprocessor, held in a slot in the mobile 6. 
The SIM card 7 in turn recognizes the ECS using spe- 



cial hardware and software and stores the message in 
memory in such a way that it may not be overwritten by 
the subscriber. Known SIM cards contain a large 
number of fixed memory locations in which the sub- 

5 scriber can store frequently dialled numbers and corre- 
sponding alphanumeric tags. The SIM card 7 of the 
invention stores the message in one of these locations, 
and then carries out a write protect operation. The loca- 
tions dedicated to storing write protected messages 

w may be designated by code numbers relating to a par- 
ticular category of advertiser. Thus, for example, car 
hire company telephone numbers can be stored in loca- 
tion 01 , hotel reservations in location 02 and so on. 
Figure 2 shows a call placing process in which a 

15 subscriber communicates with an advertiser. The sub- 
scriber, remembering that the car hire company's 
number is in location 01 as shown at 8, keys in a short 
code corresponding to the location, such as 01#. The 
mobile 6 then interrogates the SIM card 7 to retrieve the 

20 telephone number from the location. The SIM card 7 
provides both the number and the alphanumeric tag giv- 
ing the company's name and displays it to the sub- 
scriber. The user confirms that he wishes to proceed by 
pressing SEND. 

25 Next, the mobile obtains a voice channel through 
which the call proceeds to the dialled number. The GSM 
system automatically handles intra-network and inter- 
network hops. At this point the subscriber can hold a 
voice conversation with the company. 

30 Providing the correct equipment has been installed 
at the company, as soon as the call is answered, sub- 
scriber identity information read from the SIM card 7 
gives the company immediate customer billing details 
such as a name and address. 

35 The SIM card 7 also contains information detailing 
the subscriber's credit account This information is held 
in a separate, secure memory location, accessible only 
when the subscriber enters a mandatory PIN number, 
known only to himself, thus confirming that the mobile 

40 has not been stolen or lost When the subscriber has 
confirmed his car hire deal, he enters the PIN number 
into the mobile 6, requesting the credit information from 
the SIM card 7. The SIM card 7 supplies the information 
and the mobile uses existing voice/data techniques to 

45 transmit the information to the company, in a format 
secure against detection by fraudsters. The sale is con- 
firmed by the company or its equipment and the call is 
terminated. 

In this example, it is also possible to obtain a tele- 
so phone or fax number from the operator-assisted direc- 
tory enquiries system without the subscriber having to 
manually enter the number into the communications ter- 
minal which he desires to use. 

To use this feature, the subscriber calls network 
55 directory enquiries and gives the name of the person, 
company or service of which he wishes to ascertain the 
telephone number, as well as any additional information 
requested by the operator answering the call. The oper- 
ator then locates the number, confirms it and enquires 
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as to whether the number is to be transmitted verbally, 
transferred over SMS into a given memory location of 
the subscriber's SIM card or both. 

If the subscriber chooses a SIM update, the voice 
call is terminated and the operator initiates the SMS 
process by entering a sequence into a computer or 
pressing a dedicated button. The telephone number is 
then encoded into an ECS message at the despatch 
centre and is posted across the network to the sub- 
scriber's communications terminal, which transmits a 
confirmation to the despatch centre. Thus the retry 
mechanism, which operates until such a confirmation is 
received, is suspended. 

The communications terminal recognises the mes- 
sage as SMS data, passes it to the SIM card, and if 
capable, displays a "message received" banner. The 
SIM card in turn recognizes the ECS using special hard- 
ware and software, and decodes it accordingly. The 
number, and any associated alphanumeric tag, which 
would normally consist of the name of the person or 
company, are recovered together with the memory loca- 
tion in which they are intended to be stored. The 
number and name-tag are then written to that location 
and are write-protected if requested by the subscriber, 
the overwrite protection being encoded into the mes- 
sage at source. 

Subsequently, the subscriber attempts to place a 
call to the number in the known memory location by key- 
ing in the memory location number. The SIM card 
passes the telephone or fax number to the communica- 
tions terminal on demand, and upon receipt of the sub- 
scriber's confirmation, the communications terminal 
sets up the call to the desired number. 

Figure 3 shows the electronic structure of the SIM 
card 7. The card communicates with the mobile to which 
it is connected via an input/output (I/O) manager 15, 
preferably using the protocol ISO 7816 T=0. A filter 16 
receives incoming data from the I/O manager and 
detects any ECS messages from among the short mes- 
sages received. The ECS messages are sent directly to 
an electrically erasable read only memory (E 2 ROM) 17, 
which is preferably a "flash" E 2 ROM. Data can also be 
output from the E 2 ROM directly to the I/O manager 15. 
The remaining blocks shown in figure 3 are standard 
components of a SIM card. 

Figure 4 shows how the E 2 ROM is organized. A 
root directory 18 contains a SIM administration and 
identifier 19, a GSM directory and network data 20, and 
a telecom directory 21 . 

The telecom directory in turn contains memory 
locations as follows: "abbreviated dial numbers" 22, 
"capability configuration" 23, "short messages" 24, 
"fixed dial numbers" 25, and "charging counter" 26. 
Each block represents a plurality of memory locations. 
The frequently dialled numbers and corresponding 
alphanumeric tags are stored at locations 22. 

The "abbreviated dial numbers" locations 22 and 
the "short messages" locations 24 each have an asso- 
ciated locking control file 27, 28 respectively. The lock- 



ing control files constitute means for read/write 
protecting and removing read/write protection from their 
associated memory locations. The locking control files 
27, 28 will typically be in the telecom directory 21 as 

5 shown, however they can be located elsewhere such as 
in an administration directory. 

Figure 5 is a flowchart illustrating the operation of 
the SIM card 7, which uses the specially fabricated 
hardware and software which has been described 

10 above to implement the operations illustrated. At loz- 
enge 9, messages, requests, and instructions having 
ECS are distinguished from those without Each of 
these ECS types consists of a data stream headed by a 
command which is one of at least four types: write com- 

15 mands for the messages, read commands for the 
requests for information, attribute commands for lock or 
unlock instructions and run commands for instructions 
to run a program. 

The command and data types are decoded at box 

20 1 0 and acted on in one of the four paths 11-14. 

Path 1 1 handles the write commands to store mes- 
sages starting at a location specified therein. Path 12 
handles the read commands; again, the requests for 
information contain a location to be accessed first Suc- 

25 cessive locations are read and the data stored in a 
buffer until the required amount of data has been read. 
The data in the buffer is then encoded into the ECS for- 
mat and despatched from the mobile using SMS to the 
calling party. 

30 In path 13, attribute commands are used to lock or 
unlock specified memory locations and render them 
accessible or inaccessible, either to calling parties or to 
the subscriber. In path 14, run commands cause a pro- 
gram stored in the SIM card to be run. 

35 The basic ECS system is expandable to up to 255 
internal shell commands of which write, read, 
lock/unlock and run are four examples. The specific pro- 
tocol used for the transfer of information is not fixed and 
could be IS07816 T=0 or any other suitable protocol. 

40 The internal shell commands are a supplement to 
the ability of the system to create external file objects 
within the SIM card 7. The file objects are of two types: 
Application Data File Programs (ADFP's) containing 
functional data which can be executed by the SIM card 

45 processor and can self modify if required and Applica- 
tion Data Files (ADF's) containing non-functional data 
which does not have these capabilities. Existing 
ADF(P)'s can be modified over-the-air enabling 
advanced facilities such as personalisation, re-person- 

so alisation or downloadable phone book. 

The SIM card 7 has a directory structure, similar to 
that of a computer disk, and new ADF(P)'s can be 
downloaded into any directory over the air. Also over the 
air, directories can be created, deleted and modified, 

55 multiple tree directory operations can be carried out and 
ADF(P)'s that are no longer required can be deleted. 
The amount of ADF(P) data which can be downloaded 
is limited only by the size of the E 2 ROM memory of the 
card. 
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The invention, as described, greatly extends the 
applications of SIM cards. For example, using the Value 
Added Services Directory, subscribers can book hotels 
and airline seats over their mobiles quickly and easily. 

An additional advantage of this feature of invention s 
is that the geographical distribution of messages to 
cards in a specific area such as the South of France is 
facilitated. Thus advertisers can direct their messages 
to ail mobile subscribers in the specific area. This is par- 
ticularly useful when subscribers "roam" from one area 10 
to another and have no knowledge of local services. 

The directory enquiries download enables contact 
telephone or fax numbers to be delivered to a sub- 
scriber's communications terminal without any interven- 
tion by the subscriber. The process of manually entering is 
a number whilst engaged in a call to the operator is 
often dangerous, especially when the subscriber is driv- 
ing. 

* The ability of the system to download ADF(P)'s 
means that additional services can be added to the SIM 20 
card over the air while maintaining total compatibility 
with the existing cellular system. Thus the SIM card 
could acquire the functions of a credit card, passport, 
driving licence, car park pass, membership card and so 
on, becoming a multiservice card. Also, dynamically 25 
updatable services can be added which require a differ- 
ent process to be run each time a service is accessed. 

Once the card has extra services on it, it can be 
used outside of the mobile phone environment if desired 
as a standalone item. This can be read from or written 30 
to by a dedicated piece of hardware, such as a point of 
sale machine. If desired, the new services can be 
deleted, however the card will never lose its mobile 
phone SIM capability. In addition, if the card has extra 
services, they will continue to function even if the sub- 35 
scriber has been disconnected from the mobile phone 
network, unless otherwise desired. 

Modifications are possible without departing from 
the scope of the invention. 

For example, the SIM card can be trained only to 40 
receive messages detailing services relevant to the sub- 
scriber's needs. 

Claims 

45 

1. A telecommunications system comprising at least 
one host station (1) and a plurality of subscriber 
units the or each host station being operable to 
transmit a message to at least one of the subscriber 
units, and each subscriber unit having a multiplicity so 
of fixed memory locations (22) and means respon- 
sive to the detection of the message to store the 
message in a selected one of the fixed memory 
locations, which can be accessed from the sub- 
scriber unit when required, said memory locations ss 
(22) being provided in an integrated circuit card (7) 
or other module which is removably connected to 
said subscriber unit, characterized in that each sub- 
scriber unit is adapted to transmit a signal, from the 



or each host station or the user of said subscriber 
unit, to said module, said module containing means 
operable to act on receipt of such a signal to deter- 
mine and undertake an appropriate response to 
said signal. 

2. A system as claimed in claim 1 , wherein the or each 
host station (1) is operable to overwrite a message 
stored in any one of said multiplicity of fixed mem- 
ory locations (22) at each subscriber unit. 

3. A system as claimed in claim 1 or claim 2, wherein 
each subscriber unit comprises means arranged to 
receive a signal from said module and to present 
information from said signal to the user of said sub- 
scriber unit or to transmit said signal to at least one 
of said host stations. 

4. A module (7) for controlling a subscriber unit in a 
telecommunications system having at least one 
host station (1), said module (7) being removably 
connectable to a transceiver (6) of the subscriber 
unit, and comprising a multiplicity of fixed memory 
locations (22,24), and means responsive to the 
detection of a message transmitted remotely 
thereto to store the message in a selected one of 
the fixed memory locations, characterized by 
response means operable to act on receipt of a sig- 
nal, from the or each host station or the user of said 
subscriber unit to determine and undertake an 
appropriate response to said signal. 

5. A module (7) as claimed in claim 4, wherein said 
response means is arranged to request further 
information, such as a personal identification 
number (PIN). 

6. A module (7) as claimed in claim 5, wherein said 
response means includes means for comparing 
said input information with information stored in 
said module, and means for determining a 
response dependent on the outcome of said com- 
parison. 

7. A module (7) as claimed in claim 4, wherein said 
response means includes means for running a pro- 
gram stored in said module. 

8. A module (7) as claimed in any one of claims 4 to 7, 
wherein each memory location (22) is associated 
with a simple, short code, and includes means 
responsive to the entry of each code to retrieve 
data from the associated memory location. 

9. A module (7) as claimed in any one of claims 4 to 8, 
wherein the or each message, request for informa- 
tion and instruction transmitted is in a specific for- 
mat and the module (7) includes means (16) for 
recognising the specific format. 
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1 0. A module (7) as claimed in any one of claims 4 to 9, 
including means (27,28) for rendering any or all of 
said fixed memory locations accessible or inacces- 
sible from either the subscriber unit or the host sta- 
tion. 5 

11. A module (7) as claimed in any one of claims 4 to 

10, including a directory structure (21) within which 
files can be stored. 

10 

12. A module (7) as claimed in any one of claims 4 to 

11, wherein the module is in the form of an inte- 
grated circuit card. 

1 3. A system as claimed in claim 1 or claim 2, compris- is 
ing a module as claimed in any one of claims 4 to 

12. 

i 

20 



25 



30 



35 



40 



45 



50 



55 



EP 0 748 135 A2 



Is 



MUTER- NET WORK LIN K 



switch 



GSM 
SWITCH 



INTERIM 
C5M 
SWITCH 



YOtAFONE UKiL 




EP 0 748 135 A2 



01 AVLS CRtS 
•r*+ 81- °ISttSA& 



5 



Fig.2 





1- 








m 




a 






jg S 




EP 0 748 135 A2 



-J 
< 

O 



CO 

en 
IX 





f 

Mi 

I§ 

* < 



) 





D 

o 




r 

o 











EP 0 748 135 A2 



- 


Rom 














Root 




AprniN/ 








\ 


TELecom 







fig 4 



20 



/VO'S- 



CoMfieiUWIW 



22 



Is 



* 



£oc King- 
Go ntKol 

Fng.^^2? 



2^ FtLf 



roflL No's. 

\ 


2T 






-26 



EP 0 748 135 A2 



1 


f ■ 


MSSS ACS 







DOES ^ 
MESSAGE 

ECS? yS YSS 



DISPLAY SM.S 
MESSAGE TO USER 



OFFE2. USE* SIM 

storage omo 




DATA 

DECODED 

OK 



DERIVE 
LOCATION 
& KiO OF BYTES 



DECODE COMMAKD 
AND DATATYPES 



I 



"DATA CORRUPT 
OR 

INVALID CDblKlE 



STORE EATA 
IN LOCATION! 



DlSCACb "DATA 



lRCfcEMENT 
LOCATION 




Fid.5 



EP 0 748 135 A2 






XES 


EEK.l\je LOCATION 
£ NO. OF BYTES 






fcEftD "DATA FfcOM 
LOCATION STDKE .' 
BUFFER 


I 


t 




1HCLEMEMT 
LOCATION 


A 


sT^TWE LAST >— i 



YES 

v 

DER.IVJE LOCATION 
& LOCK. TYPE 



A.OCATI0I 



• 




BiCOUE BUFFER 
, IWTB ECSfttVlftT 




r 


t)ES?ATCH OYER SMS 
, TO CALL1NC P/KTY 


7 _ 





13 



IS 

THIS A VlRlTI 

PROTECT 
? / NO 



> 


r Y6S 


LOCK 


LOCATION 


> 





UNLOCK 
LOCATION 



1 


YES 




SERtVE LOCATION 
a CHECK WAHfcLE 






f 


14 


USING CHECK UAHDLE 
VALIDATE LOCATION 






YES 


RUM PfcogtAMME 

AT LOCATION 








Fig.5(coati.) 



MO. t>lRECTO«.Y 



1 f 



